From 51367fb2a0f4d4eeb8885de25821e757e3830f9d Mon Sep 17 00:00:00 2001
From: Anthony Volk <14987227+anth-volk@users.noreply.github.com>
Date: Mon, 12 Oct 2026 17:35:08 +0400
Subject: [PATCH] Publish to PyPI with trusted publishing

Add environment: pypi and id-token: write to the job that runs
pypa/gh-action-pypi-publish, and drop the user/password inputs that
passed the org-wide secrets.PYPI token, so the upload uses OIDC.

Add a changed fragment so merging cuts a patch release. Move the two
fragments under changelog.d/fixed/ to changelog.d/<name>.fixed.md:
bump_version.py only reads files at the top of changelog.d, so it
exited with "No changelog fragments found" and has failed the
Update versioning job on every push since #550.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .github/workflows/push.yaml                               | 8 ++++++--
 ...n-category.md => fix-climate-action-category.fixed.md} | 0
 ...rate-to-app-token.md => migrate-to-app-token.fixed.md} | 0
 changelog.d/trusted-publishing.changed.md                 | 1 +
 4 files changed, 7 insertions(+), 2 deletions(-)
 rename changelog.d/{fixed/fix-climate-action-category.md => fix-climate-action-category.fixed.md} (100%)
 rename changelog.d/{fixed/migrate-to-app-token.md => migrate-to-app-token.fixed.md} (100%)
 create mode 100644 changelog.d/trusted-publishing.changed.md

diff --git a/.github/workflows/push.yaml b/.github/workflows/push.yaml
index 4b25af3c2..4ee611dd6 100644
--- a/.github/workflows/push.yaml
+++ b/.github/workflows/push.yaml
@@ -89,6 +89,12 @@ jobs:
           FOLDER: docs/_build/html  # The folder the action should deploy.
   Publish:
     runs-on: ubuntu-latest
+    # PyPI trusted publishing: uploads accepted only from this workflow in the
+    # pypi environment (limited to master). No stored token.
+    environment: pypi
+    permissions:
+      contents: write  # publish-git-tag.sh pushes the version tag
+      id-token: write
     if: |
       (github.repository == 'PolicyEngine/policyengine-canada')
       && (github.event.head_commit.message == 'Update PolicyEngine Canada')
@@ -111,8 +117,6 @@ jobs:
       - name: Publish a Python distribution to PyPI
         uses: pypa/gh-action-pypi-publish@release/v1
         with:
-          user: __token__
-          password: ${{ secrets.PYPI }}
           skip_existing: true
   Deploy:
     if: |
diff --git a/changelog.d/fixed/fix-climate-action-category.md b/changelog.d/fix-climate-action-category.fixed.md
similarity index 100%
rename from changelog.d/fixed/fix-climate-action-category.md
rename to changelog.d/fix-climate-action-category.fixed.md
diff --git a/changelog.d/fixed/migrate-to-app-token.md b/changelog.d/migrate-to-app-token.fixed.md
similarity index 100%
rename from changelog.d/fixed/migrate-to-app-token.md
rename to changelog.d/migrate-to-app-token.fixed.md
diff --git a/changelog.d/trusted-publishing.changed.md b/changelog.d/trusted-publishing.changed.md
new file mode 100644
index 000000000..01577bf04
--- /dev/null
+++ b/changelog.d/trusted-publishing.changed.md
@@ -0,0 +1 @@
+Publish to PyPI with trusted publishing (OIDC) from the `pypi` environment instead of a stored API token.